-3

I need to write (in PHP, if that matters) my own password generator to generate simple passwords. Passwords that will be used by kids or elderly people only. That will generate passwords that are easy to remember, yet still has at least a minimum level of security. Something probably as close to XKCD #936 as possible.

A living example of what I am talking about is DinoPass service.

So far (by analyzing how DinoPass works) I came with the following business assumptions:

  • Take two random words out of English dictionary
  • Generate a random number in [10-99] range
  • Concatenate all three together

Are there any other principles that I should take into account? Or anything else that I need to take a look at or know about?

Clarification: I am aware that passwords like above are much less secure than those generated by a strong password generator. But, I am just a mere developer that fulfills business requirements. I have risen my doubts with the product manager and was rejected here.

2
  • 1
  • 1
    “I am aware that passwords like above are much less secure than those generated by a strong password generator.” No, they're really not. Passphrases can be memorable, easy to type, and just as secure as a bunch of letters, numbers, and symbols. It all depends on the entropy, and that your source of randomness is cryptographically secure. I use such passphrases generated by my password manager all the time, but I tend to use 2 words only for lower-security phrases that I need to memorize and type frequently.
    – amon
    Commented Jun 4, 2022 at 17:19

1 Answer 1

2

There are a couple of things to consider I think:

  1. First of all you should limit your words to a range of letters or at least have a minimum length; e.g. You don't want IA10 to be a valid password. Maybe even require a minimum total password length, so when you have two short words you choose an additional word to pad the length. Additionally you might want to limit your maximum length as well. Because I don't think "pneumonoultramicroscopicsilicovolcanoconiosis" is going to be easy to remember.

  2. You are clearly limitting yourself if you only use lower or upper case instead of mixing those up.

  3. Mixing it up with symbols is not going to increase your safety significantly I'd assume but make memorization significantly harder.

Some small calculations; If there are 10^5 Words (which is way more than most people know) in your list you will have 10^10 * 90 ≈ 10^12 different combinations. A password using a charset of 128 characters with length 6 will have about the same amount of different combinations.

I'd assume that the laptop I am currently writing this on will be able to check about 10^8 combinations per second, meaning your password will be toast in 10 seconds at the worst, most likely earlier

4
  • Thanks for the ideas, examples and calculations. Just a completely off-topic side comment. It always makes me laugh when I see all those calculations telling my that my password will toast in 10 seconds. Because these assumptions never take into consideration that my system will simply lock given user for 30 minutes after 10th failed login attempt.
    – trejder
    Commented May 31, 2022 at 20:12
  • 4
    No one is gonna try attacking your password through your system but rather attacking the hash if it is ever leaked. Which is not entirely unlikely
    – SirHawrk
    Commented Jun 1, 2022 at 5:54
  • @SirHawrk then the calculation is still wrong. Why crack just one hash at a time? Commented Jun 3, 2022 at 18:44
  • A hash rate of 10^8/s is on the higher end of what I'd expect, assuming CPU cracking of cryptographic hash functions on consumer hardware. Things will be significantly slower when state of the art password hashing functions such as bcrypt or Argon2 are used. Thus, in practice, even shorter diceware-style passwords will be sufficiently secure for many use cases.
    – amon
    Commented Jun 4, 2022 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.